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DETAILED ACTION 

CONTINUED EXAMINATION UNDER 37 CFR 1.114 

1 . A request for continued examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1 .17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.114, and the fee set 
forth in 37 CFR 1 .17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 
07/03/2009 has been entered. 

RESPONSE TO ARGUMENTS 

2. Applicant's arguments filed 07/03/2009 have been fully considered but they are 
not persuasive. Currently, claims 22-30 are cancelled; claims 32-40 are withdrawn; and 
claims 1-21 and 31 are pending for examination. 

3. In response to applicant's arguments with regard to the independent claim 1 
rejected under 35 U.S.C. 103(a) that the combination of the references does not 
teach/suggest the claimed feature the target object determining access authorization 
because Scheifler and Colburnu both teaches determined security measures using a 
centralized authority, as Scheifler teaches permission object (i.e. not target object) that 
determine whether a requested permission is authorized and Colburnu teaches security 
measures are determined by attributes obtained from the call tack to determine whether 
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particular conditions are met to permit an access instance to access a particular target; 
applicant's arguments have fully been considered, but are not found to be persuasive. 

The examiner respectfully disagrees, because the examiner is not fully clear 
where in either Scheifler or Colburnu teaches centralized authority, as it seems neither 
Scheifler nor Colburnu disclosed wording such as "central" or "centralized" 
authorization. Furthermore, the examiner is relying on Colburnu , not Scheifler , for the 
teaching/suggesting of the target object determining access authorization, as in 
accordance to applicant's own argument, the target object determined access 
authorization by checking it own security policy (applicant's argument on page 9, lines 
26-27), and Colburnu teaches a target object (Fig. 8, ref. 160) having its own security 
policy (Fig. 8, ref. 184, 194) for determining access authorization to the target object. 
Additionally, no where in either Scheifler or Colburnu teaches that by combining with the 
other, the resulting combination would not function properly. 

4. In response to applicant's arguments with regard to the independent claim 1 
rejected under 35 U.S.C. 103(a) that the combination of the references does not 
teach/suggest every claimed features because Scheifler 's disclosure of implied 
permission (col. 12, II. 46-55) does not constitute determining access to other interface 
of a target object; applicant's arguments have fully been considered, but are not found 
to be persuasive. 

The examiner respectfully disagrees, because the examiner is not fully clear why 
Scheifler 's disclosure of implied permission does not constitute determining access to 
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other interface of a target object, as Scheifler teaches the implied permission still need 
to be determined, in order to have knowledge of access authorization of what is implied. 

5. In response to applicant's arguments with regard to the independent claim 1 
rejected under 35 U.S.C. 103(a) that the combination of the references does not 
teach/suggest the claimed feature the target object determine whether access to a 
particular interface base on a call to the first interface by checking its own security 
policies; applicant's arguments have fully been considered, but are not found to be 
persuasive. 

Please note that the features upon which applicant relies (i.e., checking its own 
security policies) are not recited in the rejected claim(s). Although the claims are 
interpreted in light of the specification, limitations from the specification are not read into 
the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993). 

The examiner respectfully disagrees, as the examiner relined on the references 
as following for the teaching of the above claimed feature: 

Scheifler teaches determining whether access to a particular interface (e.g. write 
to any specific file in the directory, such as "c:/thisfile") base on a call to the first 
interface (e.g. write to any file in a directory, such as "c:/") (Fig. 1 ; Fig. 4-6; col. 4, 1. 51 
to col. 5, 1. 3 and col. 9, 1. 1 1 to col. 14, 1. 38) 

Colburnu the target object (Fig. 8, ref. 160) determine access authorization by 
checking its own security policies (Fig. 8, ref. 184, 194) (col. 1, 1. 12 to col. 3, 1. 45; col. 
7, II. 26-52 and col. 11,11.25-51). 
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Therefore, the resulting combination of the references further teaches the target 
object determine whether access to a particular interface base on a call to the first 
interface by checking its own security policies. 

I. ELECTION / RESTRICTION 

6. This application contains claims directed to the following patentably distinct 
species 

Specie I: Claims 1-21 and 31 are directed to Figure 6. 
Specie II: Claims 32-40 are directed to Figure 8. 

The species are independent or distinct because claims to the different species 
recite the mutually exclusive characteristics of such species. In addition, these species 
are not obvious variants of each other based on the current record. 

Applicant is required under 35 U.S.C. 121 to elect a single disclosed species for 
prosecution on the merits to which the claims shall be restricted if no generic claim is 
finally held to be allowable. Currently, claim 1 is generic. 

There is an examination and search burden for these patentably distinct species 
due to their mutually exclusive characteristics. The species require a different field of 
search (e.g., searching different classes/subclasses or electronic resources, or 
employing different search queries); and/or the prior art applicable to one species would 
not likely be applicable to another species; and/or the species are likely to raise different 
non-prior art issues under 35 U.S.C. 101 and/or 35 U.S.C. 112, first paragraph. 
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Applicant is advised that the reply to this requirement to be complete must 
include (i) an election of a species to be examined even though the requirement 
may be traversed (37 CFR 1 .143) and (ii) identification of the claims encompassing 
the elected species, including any claims subsequently added. An argument that a 
claim is allowable or that all claims are generic is considered nonresponsive unless 
accompanied by an election. 

The election of the species may be made with or without traverse. To preserve a 
right to petition, the election must be made with traverse. If the reply does not distinctly 
and specifically point out supposed errors in the election of species requirement, the 
election shall be treated as an election without traverse. Traversal must be presented at 
the time of election in order to be considered timely. Failure to timely traverse the 
requirement will result in the loss of right to petition under 37 CFR 1.144. If claims are 
added after the election, applicant must indicate which of these claims are readable on 
the elected species. 

Should applicant traverse on the ground that the species are not patentably 
distinct, applicant should submit evidence or identify such evidence now of record 
showing the species to be obvious variants or clearly admit on the record that this is the 
case. In either instance, if the examiner finds one of the species unpatentable over the 
prior art, the evidence or admission may be used in a rejection under 35 U.S.C. 103(a) 
of the other species. 
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Upon the allowance of a generic claim, applicant will be entitled to consideration 
of claims to additional species which depend from or otherwise require all the limitations 
of an allowable generic claim as provided by 37 CFR 1.141. 

During a telephone conversation with Shawn Diedtrich (Reg. # 58,176) on 
08/20/2009 a provisional election was made with traverse to prosecute the invention of 
Specie I, claims 1-21 and 31. Affirmation of this election must be made by applicant in 
replying to this Office action. Claims 32-40 are withdrawn from further consideration by 
the examiner, 37 CFR 1 .142(b), as being drawn to a non-elected invention. 

II. REJECTIONS BASED ON PRIOR ART 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. Claims 1-21 and 31 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Scheifler etal. (US Patent 6,1 38,238) in view of Colburn et al. (US Patent 
6,173,404). 



8. As per claims 1 , 20-21 and 31 , Scheifler teaches a method, a system and a 
computer readable medium storing instructions for controlling a computer device for 
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controlling access to an object in an operating system, the method, system and 
computer readable medium comprising: 

a module configured means for receiving a call from an external thread (Fig. 6, 
ref. 6200) to a first interface (e.g. write to any file in a directory, such as "c:/") of a target 
object (Fig. 6, ref. 4500-1 ) (Fig. 1 ; Fig. 4-5; col. 4, 1. 51 to col. 5, 1. 3 and col. 9, 1. 1 1 to 
col. 14, 1. 38); 

a module configured with means for determining whether the external thread has 
access to other interfaces (e.g. write to any specific file in the directory, such as 
"c:/thisfile") of the target object based on the call received at the first interface (Fig. 4-5 
and col. 11, 1. 20 to col. 13, 1. 45), wherein the determination is in association with 
implied permission; and 

a module configured with means for to grant access to the other interfaces 
according to the determination (Fig. 4-5 and col. 11, 1. 20 to col. 13, 1. 45). 

Scheifler does not expressly teach the method, system and computer readable 
medium comprising: wherein the call from an object; and the target object determining 
access to the other interfaces; 

Colburn teaches the method, system and computer readable medium 
comprising: a call received from an object (Fig. 5, ref. 100) and a target object (Fig. 8, 
ref. 160, 184, 194) determining (at the target object) access to other interfaces (col. 1,1. 
12 to col. 3, 1. 45; col. 7, II. 26-52 and col. 11, II. 25-51), in combination with Scheifler 's 
above teaching of implied permission, the resulting combination further teaches the 
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target object implementing access authorization in association with implied permission 
to other interfaces. 

It would have been obvious for one of ordinary skill in this art, at the time of 
invention was made to include Col burn 's inter-object security scheme into Scheifler 's 
object for the benefit of implementing a more robust security scheme between objects 
( Colburn , col. 3, II. 34-37) to obtain the invention as specified in claims 1 , 20-21 and 31 . 

9. As per claim 2, Scheifler and Colburn teach all the limitation of claim 1 as 
discussed above, wherein Colburn further teaches the method comprising wherein 
determining whether the external object has access to other interfaces of the target 
object further comprises examining a security policy ( Colburn , Fig. 8, ref. 184, 194) 
contained within the target object ( Colburn , Fig. 8, ref. 160) ( Colburn , Fig. 7A-7B; Fig. 8 
and col. 11,1.25 to col. 12,1.58). 

1 0. As per claim 3, Scheifler and Colburn teach all the limitation of claim 2 as 
discussed above, wherein Colburn further teaches the method comprising wherein the 
security policy is contained entirely within the target object ( Colburn , Fig. 8). 

11. As per claim 4, Scheifler and Colburn teach all the limitation of claim 1 as 
discussed above, wherein Scheifler further teaches the method further comprising 
determining whether the external object and the target object operate in a same process 
(e.g. same class of valid digital signature or not) ( Scheifler . col. 9, 1. 52 to col. 11,1. 19). 
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12. As per claim 5, Scheifler and Colburn teach all the limitation of claim 1 as 
discussed above, wherein Scheifler further teaches the method comprising wherein 
determining whether the external object has access to the other interfaces of the target 
object further comprises: identifying the other interfaces of the target object that can be 
accessed when the first interface is being requested by the external object ( Scheifler , 
col. 1 1, 1. 20 to col. 13, 1. 45), as the other interfaces must be identified in order to 
proper grant the permission via the implied permission. 

1 3. As per claim 6, Scheifler and Colburn teach all the limitation of claim 1 as 
discussed above, wherein both further teach the method further comprising determining 
a first process of the target object ( Scheifler . col. 9, 1. 52 to col. 1 1 , 1. 1 9 and Colburn . 
Fig. 8; Fig. 10; col. 1, 1. 12 to col. 3, 1. 45), such as determining whether the target 
object's first process corresponds to either valid digital signature with known keys or 
digital signature that cannot be verified thus a default key is utilized. 

14. As per claim 7, Scheifler and Colburn teach all the limitation of claim 6 as 
discussed above, wherein both further teach the method further comprising determining 
a second process of the external object ( Scheifler . col. 9, 1. 52 to col. 11, 1. 19 and 
Colburn . Fig. 8; Fig. 1 0; col. 1 , 1. 1 2 to col. 3, 1. 45), such as determining whether the 
external object's second process corresponds to either valid digital signature with known 
keys or digital signature that cannot be verified thus a default key is utilized. 
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1 5. As per claim 8, Scheifler and Colburn teach all the limitation of claim 7 as 
discussed above, wherein both further teach the method further comprising performing 
a cross-process communication between the target object and the external object 
( Scheifler , col. 9, 1. 52 to col. 11,1. 19 and Colburn , Fig. 8; Fig. 10; col. 1, 1. 12 to col. 3, 
I. 45; col. 13, 1. 44 to col. 14, 1. 34), such as allowing restrictive access to the target 
object as the target object is under valid digital signature process and the external 
object is not under valid digital signature process. 

16. As per claim 9, Scheifler and Colburn teach all the limitation of claim 1 as 
discussed above, wherein both further teach the method further comprising securing a 
channel for each interface of the target object ( Scheifler . col. 9, 1. 52 to col. 11, 1. 19 and 
Colburn , Fig. 8; Fig. 10; col. 1 , 1. 12 to col. 3, 1. 45; col. 13, 1. 44 to col. 14, 1. 34), as the 
channel is secured via a cryptographic key over a network between client and server. 

1 7. As per claim 1 0, Scheifler and Colburn teach all the limitation of claim 1 as 
discussed above, wherein both further teach the method comprising wherein 
determining whether the external object has access to the other interfaces of the target 
object further comprises analyzing access constraints within the target object ( Scheifler , 
col. 11,1.20 to col. 13, 1. 45 and Colburn . Fig. 7A-7B; Fig. 8; col. 13,1.44 to col. 14,1. 
34), as the analyzing of the implied permission is located within the target object. 
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18. As per claim 1 1 , Scheifler and Col burn teach all the limitation of claim 1 as 
discussed above, wherein both further teach the method further comprising analyzing 
interface access data stored within the target object ( Scheifler , col. 1 1 , 1. 20 to col. 13, 1. 
45 and Colburn , Fig. 7A-7B; Fig. 8; col. 13, 1. 44 to col. 14, I. 34). 

1 9. As per claim 12, Scheifler and Colburn teach all the limitation of claim 1 as 
discussed above, wherein both further teach the method further comprising determining 
whether the target object and the external object are in a same protection domain 
( Scheifler , Fig 4; col. 11, 1. 20 to col. 13, 1. 45 and Colburn , Fig. 8). 

20. As per claim 1 3, Scheifler and Colburn teach all the limitation of claim 1 2 as 
discussed above, wherein both further teach the method comprising wherein the 
protection domain is a process ( Scheifler , Fig 4 and col. 9, 1. 52 to col. 13, 1. 45 and 
Colburn , Fig. 8), wherein the process is associated with valid digital signature and un- 
validated digital signature. 

21 . As per claim 14, Scheifler and Colburn teach all the limitation of claim 1 as 
discussed above, wherein Colburn further teaches the method comprising wherein the 
target object sets the target object's own security policy ( Colburn , Fig. 8), the target 
object sets the target object's own security policy as the access constraints and access 
authorization resides within the target object. 
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22. As per claim 1 5, Scheifler and Col burn teach all the limitation of claim 1 as 
discussed above, wherein Scheifler further teaches the method comprising wherein 
determining whether the external object has access to the other interfaces further 
comprises determining capabilities of the external object ( Scheifler , col. 9, 1. 52 to col. 
13, 1. 45), as the capability corresponds to the capability of transferring data along with 
the know key or without the know key. 

23. As per claim 16, Scheifler and Colburn teach all the limitation of claim 1 5 as 
discussed above, wherein Colburn further teaches the method comprising further 
comprising mapping capabilities of the external object to the other interfaces of the 
target object ( Scheifler , col. 9, 1. 52 to col. 13, 1. 45), such as mapping the capability of 
transferring data with the know key to other interfaces for grater access. 

24. As per claim 1 7, Scheifler and Colburn teach all the limitation of claim 1 as 
discussed above, wherein both further teach the method comprising wherein the target 
object and the external object are created using a same methodology (e.g. object 
oriented by Java) ( Scheifler . col. 9, 1. 52 to col. col. 11, 1. 19 and Colburn . col. 1, 1. 12 to 
col. 3, 1. 45). 



25. As per claim 1 8, Scheifler and Colburn teach all the limitation of claim 1 as 
discussed above, wherein Colburn further teaches the method comprising wherein the 
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target object and the external object are ' 
to col. 3, 1. 45). 
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in a view hierarchy ( Colburn , col. 1, 1. 12 



26. As per claim 1 9, Scheifler and Colburn teach all the limitation of claim 1 8 as 
discussed above, wherein Colburn further teaches the method comprising wherein a 
view has a parent calling interface, a child calling interface, and a child managing 
interface ( Colburn , col. 6, II. 29-52), as the hierarchal relation between parent-child is 
well known with the corresponding above interfaces for the parent and the child. 
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III. CLOSING COMMENTS 

Conclusion 

a. STATUS OF CLAIMS IN THE APPLICATION 

The following is a summary of the treatment and status of all claims in the 
application as recommended by M.P.E.P. 707.07(i): 

ad) CLAIMS REJECTED IN THE APPLICATION 

Per the instant office action, claims 1-21 and 31 have received a first action on 
the merits and are subject of a first action non-final. 

b. DIRECTION OF FUTURE CORRESPONDENCES 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Chun-Kuan (Mike) Lee whose telephone number is 
(571 ) 272-0671 . The examiner can normally be reached on 8AM to 5PM. 

IMPORTANT NOTE 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Alford Kindred can be reached on (571) 272-4037. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/C.K.L./ 



August 21 , 2009 



Chun-Kuan (Mike) Lee 

Examiner 

Art Unit 2181 



/CHUN-KUAN LEE/ 



Examiner, Art Unit 2181 



